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1.0 Introduction 


1.1 The Information Commissioner's Office (ICO) is the UK’s independent 
authority set up to uphold information rights in the public interest, 
promoting openness by public bodies and data privacy for individuals. The 
ICO monitors and enforces in respect of the following legislation: 


Data Protection Act 2018; 

The UK General Data Protection Regulation (UK GDPR); 

Privacy and Electronic Communication Regulations 2003 (PECR); 

Freedom of Information Act 2000 (FOIA); 

Environmental Information Regulations 2004 (EIR); 

Environmental Protection Public Sector Information Regulations 2009 

(INSPIRE Regulations); 

e Re-use of Public Sector Information Regulations 2015; 

e Enterprise Act 2002; 

e Security of Network and Information Systems Directive (NIS 
Directive); 

e Electronic Identification, Authentication and Trust Services Regulation 
(eIDAS); 

e In addition, the ICO has a duty to audit compliance with the 

requirements or restrictions imposed by Part 4 of the Investigatory 

Powers Act 2016 in relation to the integrity, security or destruction of 

data retained by virtue of that Part. 


1.2 This policy outlines how the ICO will run formal consultations with 
external stakeholders and members of the public. 


1.3 This policy takes into account the principles contained within the 
Government’s Consultation Principles 2018. 


1.4 The policy does not provide guidance on informal dialogue with external 
stakeholders that might take place to help inform corporate or policy 
developments. 


1.5 ICO staff may be included among those being consulted, and of course 
can respond as members of the public to ICO consultations. 


2.0 Why consult 


2.1 Consultation is a two-way dialogue that allows stakeholders an 
opportunity to influence the decisions and practices of the ICO. 


2.2 The ICO will ensure that consultations have a clearly defined and 
achievable purpose. 


2.3 Asa public body, it is important that the ICO conducts open and fair 
consultation with stakeholders. Consultations involve engaging external 
stakeholders in our work to support transparency. This helps to 
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2.4 


2.5 


strengthen the working relationship between the ICO and its 
stakeholders. 


The ICO values consultation as an opportunity to deepen understanding 
on specific issues and take into account the views of stakeholders and the 
public. This enables the ICO to seek feedback on its understanding of 
issues and whether the proposed policy options are necessary or 
desirable. 


Consultation also enables the ICO to identify reasonable and realistic 
expectations of stakeholders thus helping to improve its effectiveness as 
a regulator. 


Statutory obligation 


2.6 


2.7 


2.8 


3.0 


3.1 


3.2 


3.3 


The DPA 2018 does not impose a general requirement on the Information 
Commissioner to publicly consult on all guidance, policies or codes 
produced. 


There are specific requirements to consult set out in the DPA 2018. For 
example, in respect of Codes of Practice produced in accordance with 
sections 1211, 122?, 1233, 124^ and 128° DPA 2018. 


In addition, in accordance with section 160(9) DPA 2018 the Information 
Commissioner must consult the Secretary of State and such other 
persons as the Commissioner considers appropriate when producing and 
publishing guidance about regulatory action®. 


When to consult 


Consultations should be used when there is a need to consider the views 
and suggestions of stakeholders before a decision is taken about the 
approach and practices of the ICO. 


Formal consultation is appropriate when the ICO has developed its 
analysis and evidence sufficiently to articulate the range of potential 
policy options. 


A Call for Views or Call for Evidence can instead be used as part of the 
research and evidence gathering process to better understand the views 
of stakeholders. This will not constitute a formal consultation process 
under this policy. 


l Section 121(3) DOA 2018 
2 Section 122(3) DPA 2018 
3 Section 123(3) DPA 2018 
4 Section 124(3) DPA 2018 
5 Section 128(2) DPA 2018 
6 Section 160(9) DPA 2018 
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3.4 


3:5 


3.6 


A closed consultation is a more limited type of consultation involving a 
small group of experts on a particular topic. The appropriate time for a 
closed consultation may be during the scoping or drafting process, or as 
part of the product sign off. 


Informal dialogue with stakeholders may take place before consultation to 
allow the ICO to obtain evidence and make an initial assessment of the 
issues that the consultation should address. Such engagement with 
stakeholders falls outside the scope of this policy. 


In order to maintain political impartiality consultations should not be 
launched during pre-election periods, unless there are exceptional 
circumstances. If a consultation is ongoing at the time an election is 
called it should continue, but should not receive any additional promotion. 


4.0 How to consult 


4.1 


4.1.1 


4.1.2 


4.1.3 


4.1.4 


4.1.5 


4.1.6 


Process 


Every ICO consultation will involve the publication of relevant 
documents on the ICO and stakeholder consultation area of the ICO 
website. 


The web page will provide enough information to ensure that those 
consulted understand the issues and are able to give informed 
responses. 


There will be a clear explanation of what the consultation is designed 
to address and what documents or processes it is intended to replace 
or update. The consultees will be made aware that the consultation 
process is the opportunity for them to give their view on the substance 
of the approach to be adopted by the Information Commissioner. 


The web page will include instructions on how to respond, the closing 
date of the consultation and will include a privacy statement. 


The consultation methods selected will be appropriate for the subject 
being consulted on and will be cost effective. They may include written 
or email responses to questions, focus groups, the use of online 
consultation software or telephone discussion. Consideration will be 
given to the risk of technical difficulties when using online consultation 
software and consultees will be informed that responses may 
alternatively be submitted in word copy. 


Consideration will be given to the nature of the questions posed in the 
consultation. A proportionate number of substantive questions will be 
asked giving consultees an opportunity to (i) comment on whether 
they agree with the approach suggested (ii) highlight any concerns (iii) 
suggest any alternative approaches. 
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4.1.7 


4.1.8 


4.1.9 


Consideration will be given to the word limits available to respondees 
when formulating their responses and whether this is reasonable 
based on all the circumstances of the specific consultation. Space will 
be provided for consultees to make free text comments. 


ICO consultations will be open to anyone wanting to take part; 
however, there may be a need to target specific groups and sectors. 
The ICO will be proactive and flexible in communicating how 
individuals and organisations can share their views and in 
disseminating consultation documents. 


Consultations will be publicised widely and key stakeholders should be 
directly approached for responses. 


4.2 Duration 


4.2.1 


4.2.2 


4.2.3 


ICO consultations will last for a proportionate period of time in 
accordance with the Government’s Consultation Principles 2018. 
Consultations will usually be between 6 and 12 weeks. The 
consultation’s closing date will be communicated, as well as the 
projected date for the final outcome or any subsequent developments. 


The length of the consultation period may be increased or decreased 
depending on the nature of the consultation, and other considerations 
such as holiday periods, emergency measures and legally-binding 
deadlines. 


The consultation paper will seek to highlight any reasons for a shorter 
consultation period being adopted. The ICO will also consider how they 
can maximise the opportunities for stakeholders to take part during 
any shorter timeframe. 


4.3 Accessibility 


4.3.1 


Any publication or correspondence produced by the ICO must comply 
with any ICO policies in relation to accessibility or translation. For 
example, the ICO Reasonable Adjustment Policy. 


4.4 Treatment of responses 


4.4.1 


4.4.2 


4.4.3 


Instructions on how to respond to the consultation will be included. 


When a response is submitted electronically, an acknowledgement will 
usually be sent by electronic means. 


The Consultation will set out details of how responses will be published 
and the intended timeframe. For example, this may be a summary of 
the responses or responses with the name of the person and/or 
organisation which gave the response removed. If we may publish 
responses we will give responders the option not to have their 
response published. We will make it clear if we intend to share 
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responses with (for example) government departments, and the form 
those responses will be shared. 


4.4.4 Responses will be treated fairly and objectively. The ICO is prepared to 
act where evidence is sufficient enough to warrant change. 


4.5 Privacy 

4.5.1 A privacy statement will be included in all consultation documents. 

4.6 Evaluation 

4.6.1 After a consultation has closed, the ICO will evaluate how successful 
the exercise was, considering the methods employed and the response 


rate. Any lessons that can be learned will then be incorporated into 
this document. 
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